quickjs: mark vulnerable for CVE-2026-1144, CVE-2026-1145

These vulnerabilities affect quickjs 2025-09-13-2 and earlier:

- CVE-2026-1144: use-after-free in Atomics Ops Handler
- CVE-2026-1145: heap-based buffer overflow in js_typed_array_constructor_ta

Upstream fix is pending: https://github.com/bellard/quickjs/pull/483

Once the PR is merged and a new release is available, this package
should be updated and the knownVulnerabilities removed.

pkgs/by-name/qu/quickjs/package.nix

@@ -121,5 +121,10 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ ];
     mainProgram = "qjs";
     platforms = lib.platforms.all;
+    # Pending upstream fix: https://github.com/bellard/quickjs/pull/483
+    knownVulnerabilities = [
+      "CVE-2026-1144"
+      "CVE-2026-1145"
+    ];
   };
 })